Part 1: Digital Identity Bill of Rights

Implementation Decisions

Before the requirements in this part can be assessed, the responsible parties must specify:

• Endorsement-vs-origination semantic definition (BOR-01): how the organization distinguishes "endorsement of pre-existing identity" from "creation of new identity." Baseline for all BOR-01 objectives.
• Revocation policy (BOR-02): documents the exclusive grounds for non-holder-initiated revocation per Utah Code § 63A-20-301(5): (a) the SEDI has been compromised, (b) the endorsement was issued in error or based on fraudulent information, or (c) the holder requests revocation.
• Digital guardian scope policy (BOR-02): enumerates the permitted credential management action types (e.g., present, delete, obtain) for digital guardians acting under Utah Code § 63A-20-201(3), drawn from Utah Code § 63A-20-201(3) (definition) and department rules, along with logging requirements.
• Review frequency (BOR-03): how often the SEDI acceptance point inventory is reviewed and updated.
• SEDI-enabled service pathway inventory (BOR-04): a published list of every SEDI-enabled service pathway and its corresponding lawful physical alternative.
• Override authorization policy (BOR-05): defines the permissible statutory bases and approval procedures for any discretionary override in the endorsement decision engine.
• Appeal and correction procedures (BOR-05): procedures for denial, correction, reissuance, and compromise recovery as required by Utah Code § 63A-20-302(4)(c).
• Log review methodology and frequency (BOR-05): how endorsement and denial logs are analyzed to detect patterns of arbitrary or discriminatory withholding.
• Guardian consent verification policy for incapacitated individuals (BOR-05): how the endorsement decision engine validates guardian consent for incapacitated individuals per Utah Code § 63A-20-302(3)(b)(ii), including what constitutes acceptable evidence of consent.
• Standards domain coverage checklist (BOR-06): the specific standards documents or rules that address each of the six legislatively enumerated domains (eligibility, issuance, endorsement, acceptance, revocation, interoperability).
• Specification detail standard (BOR-07): the criteria or external standard (e.g., RFC-level detail, reference implementation availability) against which "sufficient detail for independent implementation" is measured.
• Approved selective disclosure cryptographic mechanism(s) (BOR-08): the specific cryptographic construction(s) (e.g., SD-JWT, BBS+ signatures, AnonCreds) approved for selective disclosure and predicate proofs.
• Permitted digital-channel service distinctions (BOR-09): defines what service-channel differences are permissible (e.g., convenience features, self-service options) vs. what constitutes a prohibited fast-track or conditional benefit tied to SEDI adoption.
• Authorized surveillance exceptions (BOR-10): an enumerated list of lawfully authorized surveillance activities, if any, and the specific legal authority for each, per the "except as authorized by law" carve-out in Utah Code § 63A-20-101(10).

Minimum proximity presentation distance (BOR-11): the minimum distance (in centimeters or by reference to a presentation protocol standard) at which proximity presentation must complete without device transfer.

SEDI-BOR-01: Identity is innate and inalienable

An individual possesses an individual identity innate to the individual's existence and independent of the state, which identity is fundamental and inalienable.

Utah Code § 63A-20-101(1)

Requirement: The system SHALL NOT represent the state as the originator or creator of an individual's identity. The system's architecture SHALL reflect that identity is pre-existing and that the state's role is endorsement, not origination.

Criticality: High — Mischaracterizing the state as identity originator undermines the foundational principle of the program.

Roles: Department

Assessment Objectives

Determine if:

1. API documentation, data dictionaries, and developer-facing descriptions do not frame the system as originating or creating identity;
2. the semantic structure of the data model reflects the organization's endorsement-vs-origination semantic definition, treating identity as a pre-existing entity that is endorsed rather than a record created by the system;
3. enrollment workflows characterize the Department's role as endorsement of pre-existing identity, not creation of new identity;
4. user-facing interfaces and documentation present identity as inherent to the individual, not granted by the state;
5. architectural design documentation describes the state's function as endorsement, not origination.

Verification Methods

Objective coverage: AUTO → 1; EXPT → 2, 3, 4, 5; ADMN → 1, 3, 4

Assessment objects: Organization's documented endorsement-vs-origination semantic definition; API schemas and field definitions; enrollment workflow source code and design documents; data model documentation; user-facing application interfaces; program description documents and public communications; system architecture diagrams; developer onboarding materials and internal style guides; architecture decision records.

Statutory compliance: Expert review is mandatory because endorsement-vs-origination is an architectural and semantic property requiring human judgment. Automated scanning is recommended for catching surface-level naming violations but cannot assess semantic intent.

SEDI-BOR-02: Right to management and control

An individual has a right to the management and control of the individual's digital identity to protect individual privacy.

Utah Code § 63A-20-101(2)

Requirement: The holder SHALL have exclusive control over the storage, presentation, and deletion of their SEDI. A digital guardian as defined in Utah Code § 63A-20-201(3) may act on behalf of the holder within the scope established by department rules. No other party SHALL be able to present, modify, or revoke the holder's credential. The only grounds permitting non-holder-initiated revocation are those enumerated in Utah Code § 63A-20-301(5): (a) the SEDI has been compromised, (b)(i) the endorsement was issued in error, (b)(ii) the endorsement was based on fraudulent information, or (c) the holder requests revocation.

Criticality: Critical — Loss of holder control enables unauthorized presentations, credential theft, or non-statutory revocation.

Roles: Department, Wallet Providers

Assessment Objectives

Determine if:

1. the holder can store, present, and delete their SEDI via the wallet interface;
2. no party other than a holder (a digital guardian under Utah Code § 63A-20-201(3) is a holder per Utah Code § 63A-20-201(9)(b)) can exercise credential management actions beyond those permitted by the digital guardian scope policy;
3. no party, including  the holder,  can modify credential content after issuance;
4. revocation is limited to the conditions specified in the revocation policy: (a) compromise, (b) issuance error or fraud, (c) holder request;
5. the revocation service requires issuer-side justification mapped to an enumerated exception before processing a revocation request;
6. the revocation service logs the exception basis for every non-holder-initiated revocation;
7. a digital guardian under Utah Code § 63A-20-201(3) may only exercise credential management actions within the digital guardian scope policy, and guardian-initiated actions are separately logged;
8. no undocumented remote wipe, remote presentation, or server-side override capability exists;
9. no non-holder, non-department party can technically initiate or effect credential revocation (derived from Utah Code § 63A-20-101(2) and the revocation authority limits in Utah Code § 63A-20-301(5));
10. wallet provider terms of service prohibit non-statutory revocation.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4, 5, 6, 7, 8, 9; EXPT → 1, 2, 3, 5, 6, 7, 8, 9, 10; ADMN → 3, 4, 9, 10

Assessment objects: Wallet application source code and API documentation; credential storage and presentation interfaces; revocation service API, access controls, and audit logs; revocation status mechanism and its access controls; revocation service authentication and authorization configuration; digital guardian scope policy, permission enforcement logic, and guardian appointment records; wallet provider terms of service and contractual agreements; Department revocation policy document; department rules promulgated under Utah Code § 63A-20-302(4); server infrastructure configuration and access logs; wallet provider backend service API specifications and push-notification or device-management integration documentation.

Statutory compliance: The holder-exclusivity constraint derives from Utah Code § 63A-20-101(2) (management and control right); the revocation exceptions derive from Utah Code § 63A-20-301(5), which limits revocation authority to the department. Expert review is mandatory because verifying the absence of undocumented capabilities (objectives 2, 8), access control enforcement on the revocation API, wallet-provider revocation incapability (objective 9), and guardian scope limits requires code audit and security assessment. Automated testing covers verifiable functional properties including revocation API authorization checks and third-party revocation incapability testing. Administrative review is mandatory for contractual alignment (objective 10).

SEDI-BOR-03: Right to physical identity

An individual has a right to choose, receive, and use a physical form of identity assertion that is endorsed by the state.

Utah Code § 63A-20-101(3)

Requirement: Physical identity SHALL remain available and accepted for all purposes where SEDI is accepted. The SEDI program SHALL NOT deprecate, replace, or diminish the availability of physical identity documents. This requirement is reinforced by the anti-compulsion right in Utah Code § 63A-20-101(4) (see SEDI-BOR-04) and the format-neutrality right in Utah Code § 63A-20-101(9) (see SEDI-BOR-09).

Criticality: High — Eliminating physical identity would force SEDI adoption in violation of statutory intent.

Roles: Governmental Entities, Department

Assessment Objectives

Determine if:

1. individuals can choose between physical and digital identity formats without restriction;
2. physical identity documents remain available for issuance to individuals who request them;
3. all SEDI acceptance points in the Department's maintained inventory also accept physical identity documents;
4. no issuance-side policy, rule, or system design conditions eligibility for a physical identity document on SEDI adoption;
5. the SEDI acceptance point inventory has been reviewed within the defined review frequency.

Verification Methods

Objective coverage: ADMN → 1, 2, 3, 4, 5

Assessment objects: Department budget documents and appropriations for physical identity programs; agency service catalogs and intake procedures; SEDI integration agreements and acceptance point inventories; Department's maintained inventory of SEDI acceptance points; administrative rules and internal policy directives; public-facing service descriptions; complaint and incident records related to physical identity availability; field office and service point inspection records.

Statutory compliance: Only administrative verification is feasible because continued issuance of physical documents is an organizational and budgetary commitment, not a property of the SEDI system. No technological means can compel a government entity to maintain a physical issuance program.

SEDI-BOR-04: Right to not be compelled to use digital

An individual has a right to not be compelled by the state to possess, use, or rely upon a digital form of identity assertion in place of a physical form of identity assertion that is endorsed by the state.

Utah Code § 63A-20-101(4)

Requirement: No system, service, or process SHALL require SEDI where a physical identity is a lawful alternative. System designs SHALL include a physical identity fallback for every SEDI-enabled pathway. The service-entitlement dimension of this right (no denial, diminishment, or condition based on format choice) is addressed in SEDI-BOR-09 under Utah Code § 63A-20-101(9).

Criticality: Critical — Compelled SEDI adoption directly violates the statute and undermines public trust in the program.

Roles: Governmental Entities, Department

Assessment Objectives

Determine if:

1. the service pathway inventory is complete, current, and verified against the authoritative system and service catalog;
2. no SEDI-platform-internal system or workflow requires SEDI where a physical identity is a lawful alternative per the service pathway inventory;
3. every SEDI-enabled service workflow in the service pathway inventory includes a physical identity fallback path;
4. no government service policy for pathways in the service pathway inventory mandates SEDI enrollment as a condition of service;
5. staff training, intake procedures, and a complaint or grievance mechanism exist to prevent and detect informal or procedural compulsion at the point of service.

Verification Methods

Objective coverage: AUTO → 2, 3; EXPT → 1, 2, 3, 4, 5; ADMN → 1, 4, 5

Assessment objects: SEDI-enabled service pathway inventory and corresponding physical alternatives; service workflow diagrams and user journey documentation; service integration agreements and onboarding specifications; government agency service policies and intake procedures; authoritative system and service catalog; physical identity fallback procedures; staff training materials and attestation records; complaint and grievance mechanism documentation and incident logs.

Statutory compliance: Administrative verification is mandatory because the prohibition on compulsion extends to operational policies and service-counter practices that no technology can fully govern. Automated and expert methods are recommended to cover SEDI-platform workflows where fallback paths are technically verifiable.

SEDI-BOR-05: Right to endorsement on uniform standards

An individual has a right to state endorsement of the individual's digital identity upon meeting objective, uniform standards for eligibility and verification established by law, and a right to not have such endorsement arbitrarily or discriminatorily withheld or revoked.

Utah Code § 63A-20-101(5)

Requirement: The endorsement process SHALL be deterministic: given identical qualifying inputs, the outcome SHALL be identical regardless of applicant. Denial SHALL include a specific reason code traceable to a statutory eligibility criterion. An appeal or correction pathway SHALL exist.

Criticality: Critical — Arbitrary or discriminatory endorsement decisions violate equal protection principles and statutory mandate.

Roles: Department, Identity Proofing Entities

Assessment Objectives

Determine if:

1. the endorsement process is deterministic, such that identical qualifying inputs produce identical outcomes regardless of applicant;
2. denial responses include a specific reason code traceable to the eligibility criteria in Utah Code § 63A-20-302(6), the guardian consent verification policy for incapacitated individuals under Utah Code § 63A-20-302(2)- through (3), and identity proofing and denial procedures established by department rules under Utah Code § 63A-20-302 (4);
3. any discretionary override in the endorsement decision engine is traceable to a basis permitted by the override authorization policy and logged for audit;
4. an appeal or correction pathway conforming to the appeal and correction procedures exists and is accessible to applicants;
5. endorsement and denial logs are analyzed per the defined log review methodology and frequency to detect patterns of arbitrary or discriminatory withholding.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4; EXPT → 1, 2, 3, 4, 5; ADMN → 2, 3, 4, 5

Assessment objects: Endorsement decision engine source code and configuration; conformance test suite and test vector corpus; eligibility criteria documentation; department rules promulgated under Utah Code § 63A-20-302(4); denial reason code registry and statutory mapping table; appeal and correction procedures documentation; endorsement and denial logs (anonymized); log review methodology documentation; override authorization policy documentation; identity proofing entity agreements; override audit logs; demographic disparity analysis methodology and results.

Statutory compliance: Expert review is mandatory because assessing determinism requires test harness instrumentation against the decision engine, evaluating override pathways requires architectural analysis, and log review methodology design adequacy requires independent assessment. Administrative review is mandatory for override log review execution and demographic disparity statistical analysis. Automated testing is recommended for validating reason-code format, basic determinism properties, and appeal pathway reachability.

SEDI-BOR-06: Right to legislatively established standards

An individual has a right to have the state's operation of digital identity systems governed by clear standards established by the Legislature, including for eligibility, issuance, endorsement, acceptance, revocation, or interoperability of digital identity assertions.

Utah Code § 63A-20-101(6)

Requirement: All technical standards, rules, and specifications governing the SEDI program SHALL derive from authority delegated by the Legislature under Utah Code TitleChapter 63A,- Chapter 20. The Department SHALL promulgate these standards through the rulemaking process in Utah Code § 63A-20-202(3), including the 45-day public comment period required by subsectionUtah Code §63A-20-202 (3)(b).

Criticality: High — Operating under undisclosed or non-legislatively-established standards violates the governance framework and erodes public accountability.

Roles: Department

Assessment Objectives

Determine if:

1. all technical standards, rules, and specifications governing the SEDI program are publicly documented;
2. standards documents were subject to the public comment process required by Utah Code § 63A-20-202(3)(b), including the 45-day public comment period and issuance of responses to substantive comments before making rules effective;
3. standards address all six enumerated domains per the standards domain coverage checklist: eligibility, issuance, endorsement, acceptance, revocation, and interoperability;
4. version history and revision records are maintained for all standards documents;
5. published standards remain accessible at their canonical locations and have not been silently modified.

Verification Methods

Objective coverage: AUTO → 1, 5; EXPT → 2, 3, 4; ADMN → 1, 2, 3, 4, 5

Assessment objects: Published standards documents and their canonical URLs; rulemaking records and public comment period documentation; public comment submissions and disposition records; version control and revision history for standards; Department publication policy; Utah Administrative Rulemaking Act compliance records; Utah State Bulletin publication records; substantive comment response documentation.

Statutory compliance: Administrative verification is mandatory because the core obligation is a legislative process requirement (public rulemaking, comment periods) that no technology can enforce. Automated and expert methods are recommended to verify that published documents remain accessible and substantively complete.

SEDI-BOR-07: Right to transparency

An individual has a right to transparency in the design and operation of a state digital identity, including the right to access, read, and review the standards and technical specifications upon which the state digital identity is built and operates.

Utah Code § 63A-20-101(7)

Requirement: Technical specifications for all state-operated SEDI components SHALL be publicly available. Specifications SHALL be written in sufficient detail for independent implementation.

Criticality: High — Lack of transparency prevents public accountability and independent security review.

Roles: Department

Assessment Objectives

Determine if:

1. technical specifications for all state-operated SEDI components are publicly available;
2. specification documents and source code repositories are accessible at their canonical URLs without access restrictions;
3. specifications are written in sufficient detail for independent implementation per the defined specification detail standard;
4. published specifications accurately reflect the running system.

Verification Methods

Objective coverage: AUTO → 1, 2; EXPT → 3, 4; ADMN → 1, 2, 4

Assessment objects: Published technical specification documents; source code repositories; specification publication policy; public feedback mechanism for specification errors; system architecture documentation; deployed system configuration (for specification-to-system comparison); URL accessibility and integrity monitoring records.

Statutory compliance: Expert review is mandatory because "sufficient detail for independent implementation" is a qualitative judgment that requires domain expertise. Automated checks supplement by verifying continuous public accessibility. Administrative review ensures publication governance is maintained.

SEDI-BOR-08: Right to choose disclosed attributes

An individual has the right to choose what identity attributes are disclosed by the individual's state digital identity in accordance with standards established by the Legislature.

Utah Code § 63A-20-101(8)

Requirement: Selective disclosure SHALL be supported at the individual attribute level. The holder SHALL be able to present any subset of endorsed attributes without revealing the others. The system SHALL NOT require "all-or-nothing" disclosure.

Criticality: Critical — Failure to enforce selective disclosure exposes holder data beyond consent, violating the core privacy guarantee.

Roles: Department, Wallet Providers, Verifiers

Assessment Objectives

Determine if:

1. selective disclosure is supported at the individual attribute level;
2. the holder can present any subset of endorsed attributes without revealing the others;
3. non-disclosed attributes are cryptographically hidden, not merely UI-hidden;
4. presentation payloads contain no metadata that leaks non-selected attributes;
5. the system does not require "all-or-nothing" disclosure;
6. the approved selective disclosure cryptographic mechanism(s) are sound and non-disclosed attributes are not recoverable from the presentation proof.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4, 5; EXPT → 3, 4, 6; ADMN → 1, 2, 5

Assessment objects: Credential issuance and presentation protocol source code; selective disclosure cryptographic implementation; presentation payload samples and wire-format analysis; wallet provider agreements and contractual requirements; verifier integration guidelines and attribute request policies; conformance test suite results; credential format schemas and selective disclosure construction documentation; verifier presentation-request message samples and verifier software configuration records.

Statutory compliance: Automated testing is mandatory because selective disclosure is a directly testable cryptographic property. Expert cryptographic review supplements by verifying the soundness of the underlying disclosure mechanism. Administrative review ensures ecosystem participants are contractually bound.

SEDI-BOR-09: Right to service regardless of format

An individual has the right to any service or benefit to which the individual is otherwise lawfully entitled based on the individual's choice of a lawful format or means of identity assertion without denial, diminishment, or condition.

Utah Code § 63A-20-101(9)

Requirement: Service quality, availability, speed, and conditions SHALL NOT vary based on whether the individual uses SEDI or physical identity. No surcharge, delay, or reduced service level SHALL apply to physical identity users.

Criticality: High — Degraded service for physical identity users creates de facto compulsion to adopt SEDI.

Roles: Governmental Entities, Health Care Providers, Relying Parties

Assessment Objectives

Determine if:

1. service quality, availability, speed, and conditions do not vary based on whether the individual uses SEDI or physical identity;
2. no surcharge, delay, or reduced service level applies to physical identity users;
3. no digital-only fast-track or conditional benefit beyond the permitted digital-channel service distinctions is tied to SEDI adoption;
4. service-level agreements with relying parties prohibit format-based discrimination;
5. a complaint or reporting channel exists for format-based discrimination incidents.

Verification Methods

Objective coverage: EXPT → 1, 2, 3, 4; ADMN → 1, 2, 3, 4, 5

Assessment objects: Service-level agreements and relying party contracts; service workflow documentation for SEDI and physical identity paths; fee schedules and processing time records; complaint and reporting channel documentation; relying party integration guidelines; service catalog descriptions; operational service quality measurements and audit records; relying party compliance attestation templates.

Statutory compliance: Administrative verification is mandatory because service-level equivalence is fundamentally an operational and organizational commitment. Expert review is recommended to catch digital-only advantages embedded in system design. Automated testing is not applicable because the obligation concerns real-world service delivery, not system behavior.

SEDI-BOR-10: Right to freedom from surveillance

An individual has a right to be free from surveillance, profiling, tracking, or persistent monitoring of the individual's assertions of digital identity by the state, except as authorized by law.

Utah Code § 63A-20-101(10)

Requirement: The system architecture SHALL prevent surveillance, profiling, tracking, and correlation of presentations by the state, except as authorized by law. This includes:

• No Department-accessible component SHALL record, aggregate, or have the capability to infer presentation metadata (who presented, to whom, when, where, how often).
• No state-assigned persistent identifier SHALL be used as a correlation handle that enables cross-context linkage of a holder's identity assertions. State-assigned attribute values (e.g., a driver's license number) MAY appear as endorsed credential content, but SHALL NOT serve as the identifier that binds the holder to the SEDI infrastructure or enables the state to track the holder across presentations.
• This is an architectural requirement, not merely a policy prohibition.

Criticality: Critical — Surveillance capability, even if unused, violates the statute and creates systemic risk of abuse.

Roles: Department, Wallet Providers

Assessment Objectives

Determine if:

1. no Department-accessible component records, aggregates, or has the capability to infer presentation metadata (who presented, to whom, when, where, how often);
2. no telemetry, analytics, or logging of presentation events exists in Department-accessible systems;
3. no "phone home" network calls occur during presentation flows;
4. no state-assigned persistent identifier is used as a correlation handle that enables cross-context linkage of a holder's identity assertions;
5. the architecture prevents surveillance, profiling, tracking, and correlation of presentations by design, not merely by policy, subject only to the authorized surveillance exceptions;
6. wallet provider server infrastructure contains no tracking capabilities;
7. data retention policies in all system components explicitly exclude presentation metadata.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4, 6, 7; EXPT → 1, 3, 4, 5, 6, 7; ADMN → 5, 6, 7

Assessment objects: System architecture diagrams and data flow documentation; source code for state-operated SEDI components; network traffic captures during presentation flows; logging and telemetry configuration files; identifier schemas and database key structures; wallet provider server infrastructure source code and configuration; wallet provider agreements and contractual terms; Department data retention policies; system operator annual attestation records; third-party SDK and library dependency manifests; privacy-by-design threat models and architectural review documentation.

Statutory compliance: All three methods are mandatory. Automated testing verifies the absence of tracking mechanisms in testable components. Expert architectural review is mandatory because "by design, not merely by policy" is an architectural property requiring human judgment. Administrative verification ensures contractual and policy alignment across all system operators.

SEDI-BOR-11: Right to not surrender device

An individual has a right to not be required by the state to surrender the individual's device in order to present the individual's digital identity.

Utah Code § 63A-20-101(11)

Requirement: Presentation protocols SHALL support verification without physical transfer of the holder's device. Proximity protocols SHALL function at arm's length or greater. No "hand over the phone" flow SHALL be the sole presentation option.

Criticality: High — Requiring device surrender creates security risk (device tampering, data extraction) and violates holder autonomy.

Roles: Verifiers, Relying Parties, Governmental Entities

Assessment Objectives

Determine if:

1. presentation protocols support verification without physical transfer of the holder's device;
2. proximity presentation completes successfully at or beyond the minimum proximity presentation distance;
3. remote presentation completes without device transfer;
4. no "hand over the phone" flow is the sole presentation option;
5. verifier-side applications do not include a device handover prompt or flow;
6. verifier integration guidelines prohibit device surrender requirements.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4, 5; EXPT → 1, 2, 3, 4, 5, 6; ADMN → 4, 6

Assessment objects: Presentation protocol specifications and source code; proximity protocol range test results across representative device and reader combinations; verifier-side application source code and user interface flows; verifier integration guidelines and onboarding documentation; complaint and reporting channel documentation for device surrender incidents; verifier onboarding contracts and terms of service agreements.

Statutory compliance: Automated testing is mandatory because no-handover presentation is a directly testable protocol property. Expert review supplements by validating real-world proximity behavior across devices. Administrative review ensures verifier guidelines prohibit surrender demands that occur outside the technology layer.